Ransomware

Ransomware is malicious software that encrypts files or entire systems and only makes them accessible again after a ransom has been paid, usually in cryptocurrency. What started as opportunistic infections has grown into a professional criminal industry.

What it means

Once inside, the ransomware encrypts as much valuable data as possible and leaves a note with payment instructions. Modern gangs add double extortion: before encrypting anything they steal data and threaten to publish it if the victim refuses to pay.

Most attacks start small: a phishing email, a leaked password on a VPN or RDP service, or an unpatched vulnerability. From that first foothold, attackers often spend days or weeks moving through the network, disabling backups and security tooling before they strike. Many groups operate under a Ransomware-as-a-Service model, in which developers rent out their malware to affiliates who carry out the actual intrusions.

Why it matters

Ransomware has been one of the most costly forms of cybercrime for years. The direct damage (downtime, recovery costs and possibly a ransom) quickly runs into six or seven figures. Indirect consequences follow: breach notifications to regulators and customers, reputational damage and months of rebuilding.

The key defences are well known: multi-factor authentication on all remote access, rapid patching, network segmentation, offline backups that are actually tested, and a rehearsed incident response plan. Because the first step almost always goes through a person or a known vulnerability, it pays to have exactly those entry routes tested regularly.

Example

The WannaCry outbreak of May 2017 shows how far the impact can reach: the worm exploited a known Windows vulnerability for which a patch already existed, and within days it disrupted hundreds of thousands of systems in more than 150 countries, including parts of the UK’s National Health Service. A single unpatched machine was enough to infect an entire network.